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•• The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 



• Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

• If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

• If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

• Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
- Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 

earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )K Responsive to communication(s) filed on 10/28/2004 . 
2b)M This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 
Disposition of Claims 

4) El Claim(s) 26,27,60,61.94.95 and 103-105 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) E3 Claim(s) 26.27.60.61.94.95 and 103-105 is/are rejected. 

7) D Claim(s) is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) 13 The specification is objected to by the Examiner. 

10) S The drawing(s) filed on 17 January 2001 is/are: a)M accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 

1 1) D The proposed drawing correction filed on is: a)D approved b)D disapproved by the Examiner. 

If approved, corrected drawings are required in reply to this Office action. 

12) D The oath or declaration is objected to by the Examiner. 
Priority under 35 U.S.C. §§119 and 120 

1 3) D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 1 9(a)-(d) or (f). 

a)DAII b)D Some*c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2. D Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 

14) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. § 1 19(e) (to a provisional application). 

a) □ The translation of the foreign language provisional application has been received. 

15) D Acknowledgment is made of a claim for domestic priority under 35 U.S.C. §§ 120 and/or 121 . 

Attachment(s) 

1) 13 Notice of References Cited (PTO-892) 4) Q Interview Summary (PTO-413) Paper No(s). . 

2) d Notice of Draftsperson's Patent Drawing Review (PTO-948) 5) CD Notice of Informal Patent Application (PTO-152) 

3) CH Information Disclosure Statement(s) (PTO-1449) Paper No(s) . 6) O Other: 
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DETAILED ACTION 
Response to Arguments 

1. In response to communications filed on 10/28/2004, applicant cancels claims 1-25, 28-59, 
62-93, and 96-102 and amends claims 26, 27, 60, 61, 94, 95, and 103-105. The following claims 
26, 27, 60, 61, 94, 95, and 103-105 are presented for examination. 

2. The amendments to the specification, pages 2-4, filed on 10/28/2004 have been 
considered and the objection to the abstract has been withdrawn. Applicant has amended the 
specification to replace the "http://" with "www". The specification is still objected to because 
the format used for the hyperlinks is not an appropriate one in the amended specification, as the 
hyperlinks "www" can still be executable. Applicant is suggested to place the hyperlinks in 
quotation marks. The objection to claims 10, 42, 65, and 105 has been withdrawn with respect to 
the amended claims. 

2.1 Applicant's arguments, pages 12-17, filed on 10/28/2004, with respect to the rejection of 
claims 1-105 have been fully considered, but they are not persuasive. Applicant has amended 
the independent claims by combining some of the dependent claims to recite for example the 
step of "concluding that the security-sensitive operation is authentic also requires that all other 
components which are securely operably connected to the security core and which are involved 
in the security-sensitive operation remain connected until completion of the security-sensitive 
operation". This added limitation can be found in one of the cited art (England, column 11, line 
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54 through column 12, line 8). Applicant argues that the step of concluding is not taught by 
Matchett because Matchett discloses protection of a single protected device . Examiner 
respectfully disagrees. Applicant claims that the authentication process requires that all other 
components which are securely operably connected should remain connected until completion. 
Matchett discloses that in addition to a secure connection (column 9, lines 50 et seq.) security 
could be enhanced instructing the protected system or device to shut down should it be 
disconnected from the system 400 as recited in the previous office action (column 10, lines 3-5). 
Figure 2 shows another secure configuration to protect "one or more systems or devices" column 
8, lines 8-11. Therefore, Matchett is not concerned of protecting a single device. For at least the 
reasons cited above, Applicant has not overcome the rejection and Examiner maintains rejection. 

Specification 

3. The disclosure is objected to because it contains embedded hyperlinks and/or other form 
of browser-executable codes (see page 4, line 16; and page 29, line 7). Applicant is required to 
delete the embedded hyperlinks and/or other form of browser-executable codes. See MPEP § 
608.01. 



Double Patenting 

4. The nonstatutory double patenting rejection is based on a judicially created doctrine 
grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or 
improper timewise extension of the "right to exclude" granted by a patent and to prevent possible 
harassment by multiple assignees. See In re Goodman, 1 1 F.3d 1046, 29 USPQ2d 2010 (Fed. 
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Cir. 1993); In re LongU 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 
F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 R2d 438, 164 USPQ 619 (CCPA 
1970);and, In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969). 

A timely filed terminal disclaimer in compliance with 37 CFR 1 .321(c) may be used to 
overcome an actual or provisional rejection based on a nonstatutory double patenting ground 
provided the conflicting application or patent is shown to be commonly owned with this 
application. See 37 CFR 1.130(b). 

Effective January 1, 1994, a registered attorney or agent of record may sign a terminal 
disclaimer. A terminal disclaimer signed by the assignee must fully comply with 37 
CFR 3. 73(b). 

4.1 Claims 26, 27, 60, 61, 94, 95, and 103-105 provisionally rejected under the judicially 
created doctrine of obviousness-type double patenting as being unpatentable over claims 1 and 
18 of copending Application No. 09/764844. Although the conflicting claims are not identical, 
they are not patentably distinct from each other because the difference between the claims is that 
Application No. 09/764844 authenticating information using a card reader and the present 
application is using a biometric sensor, which would have been obvious to one skilled in the art 
because card reader, scanners, etc. are all biometric sensors and are well known in the art for 
obtaining biometric information. 

This is a provisional obviousness-type double patenting rejection because the conflicting 
claims have not in fact been patented. 
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Claim Rejections - 35 USC §103 
5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as 
set forth in section 102 of this title, if the differences between the subject matter sought to be 
patented and the prior art are such that the subject matter as a whole would have been obvious at 
the time the invention was made to a person having ordinary skill in the art to which said subject 
matter pertains. Patentability shall not be negatived by the manner in which the invention was 
made. 

5. 1 Claims 26, 27, 60, 61, 94, 95, and 103-105 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over US Patent 6,125,192 to Bjorn et al. in view of US Patent 5,229,764 to 
Matchett et aL. 

5.2 As per claims 26, 27, 60, 61, 94, 95, and 104, Bjorn et al. substantially teaches a 
method and system for providing continuous authentication of a user of a computing device, 
comprising: a security component which provides security functions, such that the security 
component can vouch for authenticity of one or more components with which it is securely 
operably connected, for example (see column 4, line 39 through column 5, line 22; see also 
column 5, line 43 through column 6, line 27); a biometric sensor component that is securely 
operably connected as one of the one or more other components to the security component, for 
example (see column 4, line 39 through column 5, line 22; see also column 5, line 43 through 
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column 6, line 27 and column 4, line 39 through column 5, line 22); securely-stored biometric 
information which identifies an owner of the computing device, for example (see column 4, line 
39 through column 5, line 22 and column 6, lines 18-27); means for obtaining from the biometric 
sensor component biometric input of a user of the computing device and means for comparing 
the obtained biometric input to the securely-stored biometric information of the owner, for 
example (see column 6, lines 27-43). 

Matchett et al. in an analogous art teaches means for repeatedly obtaining from 
the biometric sensor component such as fingerprint sensor, retinal scan etc., for example (see 
column 1, lines 60-67) biometric input of a user of the computing device and means for 
comparing the repeatedly obtained biometric input to the securely-stored biometric information 
of the owner, wherein each comparison comprises an authentication of the user, for example (see 
column 3, lines 10-55). Matchett et al. discloses that if biometric checks are increased in 
duration and/or number, security would be enhanced and user substitution to an unauthorized 
user would be prevented, for example (see column 2, lines 55-66). Therefore, it would have 
been obvious to one of ordinary skill in the art at the time the invention was made to modify the 
system of Bjorn et al. to provide teaching means for repeatedly obtaining from the biometric 
sensor component biometric input of a user of the computing device and means for comparing 
the repeatedly obtained biometric input to the securely- stored biometric information of the 
owner, wherein each comparison comprises an authentication of the user as taught by Matchett 
et al.. This modification would have been obvious because one skilled in the art would have 
been motivated by the suggestions provided by Matchett et al. so as to enhance security and 
prevent user substitution to an unauthorized user, for example (see column 2, lines 55-66). 
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Matchett et al discloses a continuous authentication by controlling any fraudulent 
including signal cut-off of the protected system during the continuous authentication (see an 
exemplary embodiment column 5, line 40 through column 6, line 28). Matchett discloses that in 
addition to a secure connection (column 9, lines 50 et seq.) security could be enhanced 
instructing the protected system or device to shut down should it be disconnected from the 
system 400 (column 10, lines 2-10). Figure 2 shows another secure configuration to protect "one 
or more systems or devices" column 8, lines 8-1 1 that meets the recitation of wherein the means 
for concluding that the security-sensitive operation is authentic also requires that all other 
components which are securely operably connected to the security core and which are involved 
in the security-sensitive operation remain connected until completion of the security-sensitive 
operation, for example (see column 10, lines 3-5). 

Therefore, it would have been obvious to one of ordinary skill in the art at the time the 
invention was made to combine Bjorn and Matchett to make determination that the secure- 
sensitive operation is authentic based on all other components which are securely operably 
connected to the security core and which are involved in the security-sensitive operation remain 
connected until completion of the operation as suggested by Matchett et aL. This modification 
would have been obvious because one skilled in the art would have been motivated by the 
suggestions provided by Matchett et al. because keeping everything connected to monitor the 
use of the protected device is part of enhancing the security of a true continuous authentication 
(see column 4, line 55 through column 5, line 6, column 6, lines 10-26). 
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As per claims 103 and 105, claim 103 is similar to claim 27 and also recites repeatedly 
obtaining biometric input over a duration of the security sensitive'operation and aborting the 
security-sensitive operation if the comparing fails at any time over the duration of the security- 
sensitive operation or if of the security-sensitive operation is determined not to be authentic. The 
combined references above disclose such limitation, (See Matchett column 6, line 49 through 
column 7, line 5) and (see also Bjorn et al. column 9, lines 4-25; column 10, lines 15-21; and 
column 16, line 44 through column 17, line 23). 

Conclusion 

6. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1 .136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 
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6. 1 Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Carl Colin whose telephone number is 571-272-3862. The 
examiner can normally be reached on Monday through Thursday, 8:00-6:30 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on 571-272-3795. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Any inquiry of a general nature or relating to the status of this application or proceeding 
should be directed to the receptionist whose telephone number is 703-305-3900. 



Carl Colin 
Patent Examiner 
February 21, 2005 




